Teams and Quick Assist Vishing Campaigns Led to Rapid Ransomware Intrusions

Microsoft and Sophos reported separate but closely aligned social-engineering campaigns in which attackers impersonated IT support staff over Microsoft Teams, phone calls, and related pretexts to trick employees into granting remote access through Quick Assist or other support tools. Microsoft attributed its activity to Storm-1811, which used vishing and email-bombing to gain access, steal credentials through EvilProxy, and deploy tools including Qakbot, Cobalt Strike, ScreenConnect, NetSupport Manager, OpenSSH tunneling, and SystemBC before rolling out Black Basta ransomware with PsExec. Microsoft said it suspended malicious Teams accounts and tenants involved in the impersonation activity and added stronger Quick Assist warnings and trust indicators.